Add JWT client authentication for OAuth token requests

[sdelamo]

Summary

• Add token endpoint JWT client assertion support for client_secret_jwt and private_key_jwt.
• Add token.client-assertion.* and openid.token.client-assertion.* configuration for lifetime, audience, issuer, subject, signing algorithm, and signer selection.
• Cover request shaping, fail-closed misconfiguration, signer behavior, per-request jti, embedded token endpoint handling, and docs for OAuth/OpenID configuration.

Release Target

• Target branch: 5.1.x
• Release target: 5.1.0
• Micronaut organization project: 5.1.0 Release
• Type label: type: enhancement

Tests

• git diff --check origin/5.1.x...HEAD
• ./gradlew :micronaut-security-oauth2:test --tests 'io.micronaut.security.oauth2.endpoint.token.request.DefaultTokenEndpointClientClientAssertionTest' --rerun-tasks

PR Assets

None. This change updates source, tests, and AsciiDoc documentation only; no rendered screenshots, PDFs, logs, archives, or generated binary artifacts are required.

Closes #1511

---

✨ This message was AI-generated using gpt-5

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds JWT-based client authentication (RFC 7523) for OAuth2/OpenID token requests, including configuration binding, request shaping, fail-closed behavior, and documentation updates.

Changes:

• Add client_secret_jwt / private_key_jwt token endpoint auth support with per-request JWT assertions.
• Introduce token.client-assertion.* and openid.token.client-assertion.* configuration (lifetime, aud/iss/sub, alg, signer).
• Add tests covering request shaping, misconfiguration failures, signer selection, and embedded token endpoint handling.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/main/docs/guide/oauth/flows/authorization-code/openid-authorization-code/openid-configuration.adoc	Documents OpenID token endpoint JWT client assertion configuration and includes generated config properties docs.
src/main/docs/guide/oauth/flows/authorization-code/oauth2-authorization-code/oauth2-configuration.adoc	Documents OAuth2 token endpoint JWT client assertion configuration and adds config properties include.
security-oauth2/src/main/java/io/micronaut/security/oauth2/endpoint/token/request/DefaultTokenEndpointClient.java	Adds client-assertion authentication handling and optional generator integration into token request securing.
security-oauth2/src/main/java/io/micronaut/security/oauth2/endpoint/token/request/JwtClientAssertionGenerator.java	Implements JWT client assertion creation/signing for client_secret_jwt and private_key_jwt.
security-oauth2/src/main/java/io/micronaut/security/oauth2/configuration/endpoints/TokenEndpointConfiguration.java	Extends token endpoint configuration interface with optional client assertion configuration.
security-oauth2/src/main/java/io/micronaut/security/oauth2/configuration/endpoints/ClientAssertionConfiguration.java	Adds a dedicated configuration interface for JWT client assertions.
security-oauth2/src/main/java/io/micronaut/security/oauth2/configuration/OauthClientConfigurationProperties.java	Binds client-assertion configuration under both OAuth2 and OpenID token endpoint config properties.
security-oauth2/src/test/java/io/micronaut/security/oauth2/endpoint/token/request/DefaultTokenEndpointClientClientAssertionTest.java	Adds tests for JWT client assertion behavior across auth methods and failure modes, including an embedded server test.
security-oauth2/src/test/java/io/micronaut/security/oauth2/configuration/OauthClientConfigurationTest.java	Adds config binding test coverage for token.client-assertion.*.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
83.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud